Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2023, 16:41

General

  • Target

    clientfmUx.exe

  • Size

    516KB

  • MD5

    38a9b7e6b93904b572e76cad2f99353c

  • SHA1

    20bd0ea13cbc76cdbb9d002a457e543d02e9d500

  • SHA256

    06b9b10a15c0b2856620dd4469c8a976bfbc42e506747a04a763dbeeaf1ecb79

  • SHA512

    b381687ef7f9f32af5b254b33bfffc287f675ba06d990df011a460c4f76c81d76546203af6bf0fc412e328d5e013e3997db56b3454002edc71ab6357e4211683

  • SSDEEP

    12288:1oPHzIcgTRo9RvHBQAC76LUkd0bpaMwdHqUz:SPHM1ohP0XAx

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

retghrtgwtrgtg.bounceme.net:3839

listpoints.click:7020

datastream.myvnc.com:5225

gservicese.com:2718

center.onthewifi.com:8118

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    explorer.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-OPX7KW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\clientfmUx.exe
    "C:\Users\Admin\AppData\Local\Temp\clientfmUx.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
          PID:2452

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\9593495e

            Filesize

            1.1MB

            MD5

            68b28f198fd237612c4bec43eb1cf994

            SHA1

            1d77229ec0651946d2937aa5b368877fca56575b

            SHA256

            636b6296acd0ca016c81a1e25e75244335fda2755a0b986bbdce918d69a6e3a9

            SHA512

            a45a73c44a62964128e25a4c91cd018baf61d65b192f868f4030782fe5de1549859fab1cb0a5371b41578c3788384430cee264c4fcefcb8b923d3eeccc9d0f5f

          • memory/2452-15-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-19-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-23-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-22-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-28-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-21-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-14-0x00007FFFD5690000-0x00007FFFD5885000-memory.dmp

            Filesize

            2.0MB

          • memory/2452-18-0x00000000003E0000-0x0000000000813000-memory.dmp

            Filesize

            4.2MB

          • memory/2452-20-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-27-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-24-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-26-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/2452-25-0x0000000000C00000-0x0000000000C84000-memory.dmp

            Filesize

            528KB

          • memory/3284-2-0x00007FFFD5690000-0x00007FFFD5885000-memory.dmp

            Filesize

            2.0MB

          • memory/3284-0-0x0000000000400000-0x0000000000488000-memory.dmp

            Filesize

            544KB

          • memory/3284-1-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB

          • memory/3284-4-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB

          • memory/3284-3-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB

          • memory/4208-8-0x00007FFFD5690000-0x00007FFFD5885000-memory.dmp

            Filesize

            2.0MB

          • memory/4208-10-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB

          • memory/4208-11-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB

          • memory/4208-13-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB

          • memory/4208-6-0x00000000740D0000-0x000000007424B000-memory.dmp

            Filesize

            1.5MB